CVEs published June 22, 2018
26 CVEs were published on June 22, 2018: 0 critical, 1 high.
- Published
- 26
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- [UNKNOWN] 389-ds-base
- 1
- [UNKNOWN] ansible · ansible
- 1
- ffi
- 1
- froxlor/froxlor
- 1
- IBM AIX
- 1
- Micro Focus Solutions Business Manager
- 1
- NetApp OnCommand Unified Manager for 7-Mode
- 1
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- 1
High 1
Medium, low and unrated 25
- CVE-2018-7682Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.Micro Focus Solutions Business Manager
- CVE-2018-12689phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and pa
- CVE-2018-12538In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSesThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-12684Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Inf
- CVE-2018-12687tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
- CVE-2018-12688tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.
- CVE-2018-1000201ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead offi
- CVE-2018-12678Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocke
- CVE-2018-12636The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th
- CVE-2017-7568NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenNetApp OnCommand Unified Manager for 7-Mode
- CVE-2018-12654Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?k
- CVE-2018-12655Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.ph
- CVE-2018-12656Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywo
- CVE-2018-12657Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?k
- CVE-2018-12658Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywo
- CVE-2018-12659SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token para
- CVE-2018-12649An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92.
- CVE-2018-1655IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory.IBM AIX
- CVE-2017-2668389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.[UNKNOWN] 389-ds-base
- CVE-2018-12648The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- CVE-2018-12641An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.
- CVE-2018-12642Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.froxlor/froxlor
- CVE-2018-12633An issue was discovered in the Linux kernel through 4.17.2.
- CVE-2018-12634CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system
- CVE-2018-12635CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs.